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REMARKS 

Reconsideration of this application is respectfully requested in view of the foregoing 
amendment and the following remarks. 

Claims 1-50 were pending in this application. Claims 9-11, 20-22, 31, 32, 45, and 46 
have been cancelled without prejudice or disclaimer to the subject matter thereof and claims 3, 4, 
14, 15, 25, 26, 39, and 40 have been amended hereby to correct matters of form. Accordingly, 
claims 1-8, 12-19, 23-30, 33-44, and 47-50 will be pending herein upon entry of this 
Amendment. For at least the reasons stated below, Applicants respectfully submit that all claims 
pending in this application are in condition for allowance. 

In the Office Action mailed April 7, 2004, claims 3, 4, 14, 15, 25, 26, 39, and 40 were 
objected to for containing trademarks/trade names. These claims have been amended to remove 
reference to the objectionable terms, thus obviating the objection. Claims 9-11, 20-22, 31, 32, 
(although Examiner apparently inadvertently listed claim 3 1 twice, Applicants assume she 
intended to list claim 32) 45, and 46 were rejected under both 35 USC § 1 12 as failing to comply 
with the enablement requirement and 35 USC § 101 as not being supported by either a specific, 
substantial and credible asserted utility or a well established utility. Without commenting on the 
substance of the rejections, the cancellation of claims 9-11, 20-22, 31, 32, 45, and 46 renders this 
rejection moot. Claims 1, 2, 5, 7, 8, 12, 13, 16, 18, 19, 23, 24, 27, 29, 30, 37, 38, 41, 43, and 44 
were rejected under 35 USC § 102(e) as being anticipated by Munson (US Patent No. 6,681, 
331) and claims 3, 4, 6, 9-11, 14, 15, 17, 20-22, 25, 26, 28, 31, 32, 39, 40, 42, 45, and 46 were 
rejected under 35 USC § 103(a) as being unpatentable over Munson, in view of Rowland (US 
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Patent No. 6,405,318), which are addressed below. To the extent these rejections might still be 
applied to claims presently pending in this application, they are respectfully traversed. 

Regarding the anticipation rejection, Applicants note that Munson generally teaches a 
manner of anomaly detection by comparing events generated on a computer to events deemed to 
be normal and determining whether the generated event is normal or abnormal, but the specific 
manner that Munson teaches to determine whether an event is normal or abnormal is quite 
different from the present invention. The system described in Munson utilizes multinomial 
distributions to determine abnormality. The present system employs neural networks that have 
been previously trained to identify normal behavior. The detected behavior is then analyzed, 
often in real-time, to determine if that particular data stream is normal. At least claims 23 and 37 
(and by incorporation each of their respective dependent claims) include specific reference to the 
above-referenced "neural networks", which are not employed by Munson in the manner claimed. 
In fact, the analysis performed by Munson relates to multinomial statistical analysis of detected 
events versus known normal events and does not involve the use of neural networks as described 
in claims 23 and 27. 

Regarding the rejection with respect to claims 1 and 12, as mentioned previously, 
Munson describes generally a manner of detecting abnormal computer behavior, but Applicants 
note that many of the claimed steps are not disclosed by Munson as asserted by the Examiner. 
Specifically, Applicant asserts that the portion cited by the Examiner with respect to element a) 
of each of claims 1 and 12 is not supported by the cited passage. Element a) specifically recites 
"each said first application profile comprises a plurality of first data strings, wherein each first 
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data string comprises a sequential mapping of instructions. . The portion cited by the Examiner 
discusses that "[d]uring the design process, the basic functions are mapped by system designers 
to specific software program modules that implement the functionality." Applicants see no 
reference in the allegedly supporting passage that discusses an application profile, data strings or 
sequential mapping instructions. 

Regarding the "second application profiles" allegedly described in Munson at co. 9, lines 
49-55, this passage discusses that each user may have a unique characteristic operational profile. 
While Applicants do not even agree that this can properly be considered the recited second 
application profile, Munson does not describe any relation between the characteristic operational 
profile and any other profile in the cited portion of column 4 relied upon by the Examiner. 
While Munson does describe a type of anomaly detection, Applicants assert that the Examiner 
has not identified portions of Munson that properly correspond to each and every element recited 
in the claims. Further, even if each element were taught as alleged by the Examiner, the recited 
comparisons of those elements certainly are not taught by Munson. 

As to Rowland, because this reference is applied only to dependent claims and fails to 
supply any of the above-cited deficiencies with respect to the Munson reference, Applicants 
assert that the combination of Rowland and Munson still does not teach each element of the 
independent claims at issue. 

Accordingly, because each element recited in each of the independent claims is not 
present in either the Rowland or Munson references, Applicants assert that claims 1, 12, 23, and 
37 along with their respective dependent claims are in condition for allowance. Should the 
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Examiner have any questions or determine that any further action is desirable to place this 
application in even better condition for issue, the Examiner is encouraged to telephone 
applicants' undersigned representative at the number listed below. 


SHAW PITTMAN LLP 
1650 Tysons Boulevard 
McLean, VA 22102 
Tel: 703/770-7900 

Date: July 7, 2004 
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